[BUG] Logs not being parsed properly in Kibana APM app

[LeaTaka]

Microsoft.NET.Sdk.Web net6.0

Elastic.Apm.NLog Version=8.6.1 Elastic.CommonSchema.NLog Version=8.6.1 Elastic.Apm.NetCoreAll Version=1.25.2 Elastic.Apm.Extensions.Logging Version=1.25.2 NLog.Web.AspNetCore Version=5.* NLog Version=5.* NLog.Extensions.Logging Version=5.*

ECK: 2.10 Elasticsearch, Kibana, Fleet, Agents: 8.11.3

The problem: Application logs (_logger.LogInformation, etc..) are parsed correctly when Ilogger is used. The erroneous parsing is visible in the Kibana APM app on the Log tab of the Service ans also on the Log tab of a Trace when correlating logs to traces. I included screenshots of the the Log tab of the Services, in red the loglines that have Elastic .json documents attached in the included zipfile. I'm not sure if either the Kibana is the problem or one of the libraries I used.

Goal: Our goal is to use EcsLayout with Nlog and Ilogger

Reproduction: Please find a zipfile attached with the following examples for reproduction purposes; Ecs-Nlog-Iloggler.zip

• app-10-dotnet application with Ilogger implementation
• app-10-dotnet console logs example
• app-10-dotnet screenshot of the behaviour in Kibana APM app on the log tab
• app-10-dotnet Elasticsearch document (the line in red on the .png screenshot) --
• app-11-dotnet application without Ilogger implementation
• app-11-dotnet console logs example
• app-11-dotnet screenshot of the behaviour in Kibana APM app on the log tab
• app-11-dotnet Elasticsearch document (the line in red on the .png screenshot)

Hope you can help solving this problem.

[bart-medfar]

I have the same issue when using serilog + elastic sink + apm on .net 8 web app

[LeaTaka]

Example pics attached of when configuring collumns in Kibana Logs ( not possible on the log tabs in the Kibana APM app )

[Mpdreamz]

Thanks for opening this issue @LeaTaka ultimately this is a bug/issue in kibana:

https://github.com/elastic/kibana/issues/176013

I tend to agree the special computed Message column should always prefer message over anything computed.

[LeaTaka]

Thanks for opening this issue @LeaTaka ultimately this is a bug/issue in kibana:

elastic/kibana#176013

I tend to agree the special computed Message column should always prefer message over anything computed.

Hi there Martijn, thanks for forwarding this to the Kibana team 👍 🌭

[Mpdreamz]

Closing this since upstream ticket got closed too: https://github.com/elastic/kibana/issues/176013

Trusting the Logs embeddable will work better but will keep an eye out.

Looking forward to a next ticket Jasper 😸